Dynamic android app recon & testing using android system tools or adb command

[LocaMartin]

Add support for executing Android-specific commands (e.g., adb, pm, dumpsys, getprop, logcat) inside Nuclei workflows to automate mobile application security testing.

This would allow Nuclei to run checks dynamically against connected Android devices, emulators, Genymotion, or Termux environments.

id: android-debuggable-app

info:
  name: Android Debuggable App Check
  author: loca
  severity: info
  description: |
    Checks if an installed Android package is marked debuggable
    using ADB shell. Useful for mobile bug bounty recon.

variables:
  pkg: "{{package}}"

executors:
  - name: sh
    cmds:
      - "dumpsys package {{pkg}} | grep -i 'debuggable=1'"

    matchers:
      - type: word
        words:
          - "debuggable=1"

Nuclei already supports executing:

• Bash / sh scripts
• Python
• JavaScript workflows

Extending execution to Android runtime commands would:

✔ automate common MAS/OHWS top-10 checks
✔ remove manual steps
✔ allow custom templates for app-specific behaviors
✔ make Nuclei applicable to mobile security testing, not just network/web